Cross-Site Scripting Vulnerability in Indico Event Management System

CVE-2025-59035

What is CVE-2025-59035?

The Indico event management system, which utilizes Flask-Multipass for multi-backend authentication, is susceptible to a Cross-Site Scripting (XSS) vulnerability. This issue arises when LaTeX math code is rendered in contribution or abstract descriptions. Users are advised to upgrade to Indico version 3.3.8 promptly to mitigate potential exploitation, especially in scenarios where external speakers, who may not be fully trusted, are invited to submit content. Employing strict content submission controls can act as a temporary workaround, but updating to the latest version remains essential.

References